Revocation & Incidents

Revocation & Incident Response

Revocation in AGF is atomic and immediate — every agent downstream of a revoked parent is suspended in the same operation. Audit artifacts ensure a full evidence trail from detection through reinstatement.

Revocation types

Single-agent revocation

Revoke one agent immediately. Useful when a specific agent credential is compromised or the agent has violated policy.

Use when

Credential leak for a specific agent
Agent anomaly score breach
Manual review outcome

POST /v1/revoke
{
  "agent_id": "did:agf:agt_01abc",
  "org_id":   "org_acme",
  "cascade":  false,
  "reason":   "credential_compromised"
}

Result: The agent's status becomes suspended. All subsequent /v1/authorize calls for this agent_id return deny with reason agent_suspended.

Branch-cut revocation

Revoke an agent and every agent delegated from it — recursively. A single API call terminates an entire delegation subtree atomically.

Use when

Parent agent compromised — all children inherit the risk
Decommissioning a team of agents
Security incident affecting a delegation chain

POST /v1/revoke
{
  "agent_id": "did:agf:agt_00root",
  "org_id":   "org_acme",
  "cascade":  true,
  "reason":   "parent_compromised"
}

// Response — entire subtree revoked atomically:
{
  "revoked": [
    "did:agf:agt_00root",
    "did:agf:agt_01abc",
    "did:agf:agt_02def",
    "did:agf:agt_03ghi"
  ],
  "count":      4,
  "artifact_id": "art_rEvk4Zp"
}

Result: All agents in the subtree are suspended simultaneously. There is no window between revocations — the operation is atomic at the database level.

Full-fleet revocation

Suspend all agents in your organisation in one call. Reserved for catastrophic incidents — root key compromise, supply-chain breach, or regulatory requirement.

Use when

Root key or signing infrastructure compromised
Regulatory or legal requirement to halt all AI agent activity
Major supply-chain incident affecting your agent codebase

POST /v1/revoke
{
  "agent_id": "__org_fleet__",
  "org_id":   "org_acme",
  "cascade":  true,
  "reason":   "root_key_compromise"
}

Result: Every active agent in the org is suspended. Contact AGF support to reinstate agents once the incident is resolved and a new root key is established.

Incident response playbook

Five steps from detection to reinstatement. The whole cycle is supported by the AGF API — no manual database operations required.

Detect

Anomaly alerts, trust score drops, or external reports surface an incident. The AGF dashboard shows which agents triggered alerts.

Contain

Immediately revoke the affected agent(s). Use cascade: true if the agent has sub-agents. Revocation takes effect within 10 ms — all subsequent decisions deny.

Investigate

Pull audit artifacts for the affected agent_id. Every decision record is signed and timestamped — you can replay the full sequence of what the agent did and when.

Remediate

Fix the root cause — rotate credentials, patch the agent code, or update the delegation policy. Register a new agent passport for the replacement agent.

Reinstate

Contact AGF to reinstate the agent with a new passport. The agent resumes with a clean trust score and a fresh audit trail.

Best practices

Revoke first, investigate later

The audit trail is preserved after revocation. Contain the incident immediately, then use artifacts to reconstruct what happened.

Use cascade by default for parent agents

If a parent agent is compromised, every child agent must be considered compromised too — cascade: true handles this atomically.

Set anomaly alert thresholds

Configure trust score thresholds in your org policy so the system alerts before a breach requires manual revocation.

Test your runbook quarterly

Run a drill: revoke a test agent in staging, confirm all downstream decisions deny, then reinstate. Know the procedure before you need it.